fix: harden terminal action endpoints #25
Reference in New Issue
Block a user
Delete Branch "codex/issue-6-terminal-actions-hardening"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Addresses #6.\n\nChanges:\n- Adds a protected POST /api/action route for status, brief, and sweep actions.\n- Hardens POST /api/sweep and /api/action with same-origin POST checks, per-IP rate limiting, sanitized audit logs, and header/body token handling without URL query tokens.\n- Adds dashboard SET TOKEN flow using x-crucix-token plus Status/Sweep controls.\n- Documents private LAN, Pangolin-authenticated, and public internet exposure settings.\n\nValidation:\n- git diff --check (only Windows CRLF warnings).\n- Added runner-side regression coverage in test/fetch-utils.test.mjs.\n\nPer runner-only constraint, no local npm/node test run was executed.
79f897f8actod7df2e4aeeAnpassen.